CVE-2021-20847

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-01 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.

Affected products

NTT DOCOMO, INC. Wi-Fi STATION SH-52A: 38jp_1_11g, 38jp_1_11j, 38jp_1_11k, 38jp_1_11l, 38jp_1_26f, 38jp_1_26g (+3)

References

https://jvn.jp/en/jp/JVN19482703/index.html
https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html
https://jvn.jp/en/jp/JVN19482703/index.html
https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html

Get alerted when CVE-2021-20847 or the next vulnerability affects your stack